# =====================================================================
# coturn — CareMeet TURN/STUN
# Ubuntu 22.04+ :  apt install coturn
# =====================================================================

listening-port=3478
tls-listening-port=5349

# The public IP clients reach. On AWS/GCP set external-ip=PUBLIC/PRIVATE
listening-ip=0.0.0.0
external-ip=YOUR.PUBLIC.IP

realm=caremeet.in
server-name=caremeet.in

# --- Ephemeral credentials -------------------------------------------
# Must match TURN_STATIC_SECRET in the signaling .env
use-auth-secret
static-auth-secret=change-me-32-bytes-min

# --- Relay port range: open these in the firewall/security group ------
# 20k ports is ample for ~2,000 concurrent relayed sessions per node.
min-port=49152
max-port=65535

# --- TLS on 5349 is what gets through hospital firewalls --------------
cert=/etc/letsencrypt/live/turn.caremeet.in/fullchain.pem
pkey=/etc/letsencrypt/live/turn.caremeet.in/privkey.pem

# --- Hardening: stop your relay being used as an open proxy -----------
no-multicast-peers
denied-peer-ip=0.0.0.0-0.255.255.255
denied-peer-ip=10.0.0.0-10.255.255.255
denied-peer-ip=127.0.0.0-127.255.255.255
denied-peer-ip=169.254.0.0-169.254.255.255
denied-peer-ip=172.16.0.0-172.31.255.255
denied-peer-ip=192.168.0.0-192.168.255.255
no-cli
no-tlsv1
no-tlsv1_1

# --- Capacity guards --------------------------------------------------
user-quota=12
total-quota=2000
# 0 = unlimited. Set a per-session bps cap if a tenant ever abuses relay.
max-bps=0

fingerprint
stale-nonce=600
pidfile=/var/run/turnserver.pid
simple-log
log-file=/var/log/turnserver.log